CVE-2026-58659 still reported for lightning 2.6.6 — suspected advisory-version mismatch #21970

Bug description

After upgrading the PyPI package lightning to 2.6.6, our Anchore container scan continues to report CVE-2026-58659. Could you confirm whether this version contains the complete fix and whether the advisory’s affected/patched version metadata needs correction?

Our scan reports:

There are two findings for this CVE, one per architecture. The package is detected through lightning-2.6.6.dist-info/METADATA.

The [2.6.6 release notes](https://github.com/Lightning-AI/pytorch-lightning/releases/tag/2.6.6) list fixes for checkpoint loading involving _instantiator and _class_path.

However, [GHSA-qqmf-gpg7-g8gw](GHSA-qqmf-gpg7-g8gw) lists affected versions as < 2022.6.15 and the patched version as 2022.6.15, while its description says the vulnerability affects versions through 2.6.5.

This appears to be an advisory-version mismatch causing a false-positive match against 2.6.6.

Could you please:

1. Confirm that the PyPI distribution lightning==2.6.6 addresses CVE-2026-58659?
2. Confirm the correct affected-version range and first patched release?
3. Provide an authoritative reference we can share with our scanner/security team, and advise where the advisory metadata should be corrected?

We are requesting confirmation and metadata review.

Thank you.

What version are you seeing the problem on?

v2.6

Reproduced in studio

No response

How to reproduce the bug

Error messages and logs

# Error messages and logs here please

Environment

#- PyTorch Lightning Version (e.g., 2.6.0):
#- PyTorch Version (e.g., 2.5):
#- Python version (e.g., 3.12):
#- OS (e.g., Linux):
#- CUDA/cuDNN version:
#- GPU models and configuration:
#- How you installed Lightning(`conda`, `pip`, source):

More info

No response

cc @ethanwharris